A hospital must remediate a broken logging system for sixty days and needs a temporary manual log review accepted by compliance. How should this be modeled in IRM?
Select an answer to reveal the explanation.
Short Explanation
When the main seatbelt is frayed, you use a temporary strap and write down that it is temporary. Same idea here: record the compensating control and the exception with an end date while the real fix is underway.
Full Explanation
When a hospital must remediate a broken logging system for sixty days and needs temporary manual log review accepted by compliance, model a time-bound compensating control and related exception while remediation proceeds. That pattern keeps the gap visible, approved, owned, and dated rather than hidden from leadership. Marking the original control permanently Effective and hiding the outage from issues falsifies posture. Replacing the authority document with a waiver memo and stopping all testing corrupts the mandate library for a local technical failure. Moving the entity out of scope until logging is rebuilt inappropriately shrinks program scope to avoid bad scores instead of managing the temporary risk. Exam caveat: compensating controls and exceptions need owners, evidence expectations, and expiry aligned to the remediation plan—not open-ended verbal agreements between teams. Operational check: document the compensating manual review procedure, open the exception with sixty-day expiry, link issues for the logging rebuild, assign hospital owners, calendar the expiry review, and report the temporary posture to compliance leadership. On expiry, either restore automated logging with retest or renew the exception with fresh approval and updated risk acceptance, retaining the full packet for health-sector auditors.